Other notes

Jump to bottom

Sam Duy edited this page Feb 14, 2018 · 1 revision

Save some configurations to a file to shorten the command we use

$ cat ~/.volatilityrc 
[DEFAULT]
PROFILE=LinuxuClinux_ARM_VersatilePBARM
LOCATION=file:////masked/sensitive/path/source/uClinux-dist/converted.raw

Finding the kernel DTB

Source: volatility/plugins/overlays/linux/linux.py

Search for: swapper_pg_dir symbol (x86) or init_level4_pgt (x64).

What is the symbol for uClinux? => ??? (Ref: [BOOK] Page.608)